Category: Cognos

Problem:
When user in IE surf to Cognos Connection to login they get a AAA-SYS-0001 error.

Error Message:
AAA-SYS-0001 : An internal error occurred.
java.lang.RuntimeException: A visa already exists for this namespace.java.lang.RuntimeException: A visa already exists for this namespace.
at com.ibm.cognos.camaaa.internal.auth.PassportImpl.add(PassportImpl.java:102)
at com.ibm.cognos.camaaa.internal.auth.handler.CreateApplicationLogonSession.handleMessage(CreateApplicationLogonSession.java:252)
at com.ibm.cognos.camaaa.internal.common.handler.HandlerWrapper.handleMessage(HandlerWrapper.java:172)
at com.ibm.cognos.camaaa.internal.auth.handler.AuthHandlerChain.invokeHandlersForward(AuthHandlerChain.java:79)…

Problem:
Slow or no login at all to a new namespace in Cognos Connection. The user surf to http://servername/cognos8 and then waits.
The other namespace setup in Cognos BI works fine.

Troubleshoot:
Instead of set the domain name in Cognos Configuration Namespace Host and port, try with the IP to the closest Microsoft Windows Domain Controller in that domain. Change to 10.0.0.78:389 if your Domain Controller uses that IP address.

You can test a change in namespace host without saving Cognos Configuration, if you right click the namespace name (under authentication in left panel) and select test, Cognos will do a authentication test to that DC on the lower IP layer and not use the Cognos dispatcher or Cognos Gateway.
When the dialog comes up for username and password, enter the user name as DOMAIN\username.
The details will show that Cognos first checks that the user exist, and there after ask for a list of all AD groups that user belongs to.
If this test take long time, the login for the Cognos user at the Cognos Gateway (iis) will take at least the same time or more.

Close Cognos Configuration without save, and your test values is gone, and your are back to the previous setup in Cognos.

Product:
Cognos BI 10.2.2
Microsoft Windows 2012 R2 ServerProblem:
In a Active Directory Domain and Forrest, when we try to add AD groups to the internal Cognos groups in Cognos Connection – Administration – Security, we can not see all groups.Solution:
AD Domain Local Groups can only be seen if they are in the same sub-domain as the Cognos Content Manager server. If the Cognos CM server is in a different domain than the DLGroup, it is not visible.

You should create a Cognos security group for your function, then to that Cognos group add AD groups from the different namespace you have created to allow users of different forest have access to the Cognos solution.

When you configure an authentication namespace for IBM® Cognos®, users from only one domain can log in. By using the Advanced properties for Active Directory Server, users from related (parent-child) domains and unrelated domain trees within the same forest can also log in. There is no cross-forest support; there must be a namespace for each forest.
If you set a parameter named chaseReferrals to true, users in the original authenticated domain and all child domains of the domain tree can log in to IBM Cognos. Users from a parent domain of the original authenticated domain or in a different domain tree cannot log in.
If you set a parameter named MultiDomainTrees to true, users in all domain trees in the forest can log in to IBM Cognos.https://www.ibm.com/support/knowledgecenter/SSEP7J_11.0.0/com.ibm.swg.ba.cognos.inst_cr_winux.doc/t_includedomainsusingadvancedproperties.html#IncludeDomainsUsingAdvancedProperties

If you specify Binding Credentials (i.e. if you fill in this section), then:
• (in some environments) it can lead to performance problems. This is because it causes Cognos to ‘unbind’ its original user and re-bind as the ‘specified’ user
• You must ensure that the password (of the user that you choose) does not change/expire

=> Therefore, only fill in the ‘Binding credentials’ section if your “test” (see later) fails. If authentication fails, specify a Windows user ID and password for the Binding credentials property.
• Use the credentials of a Windows user who has at least ‘search’ and ‘read’ privileges for that server.
• This should be a domain user who can ‘see’ the folders inside the AD where the users are located.

In order to setup SSO in a multi-domain Active Directory environment, follow these steps:

1. Launch “Cognos Configuration”
2, Create a new namespace
3. Make sure that this is set to “Active Directory” (not LDAP)
4. Use the root domain as the hostname
5. Locate “Advanced properties” and click edit/modify button
6. Enable either ‘ChaseReferrals’ or ‘MultiDomainTrees’.

TIP:

ChaseReferrals – This will allow users from ‘child’ domains (i.e. domains below the domain that your namespace is connected to) to logon

This is often the best choice (for performance reasons).

MultiDomainTrees – Allows users from ALL domains (inside the forest) to logon

If you are unsure where your users will be located, ‘MultiDomainTrees’ can be the best option (to ensure that all users are able to logon, wherever they are located).

However, this means that searches will traverse the entire forest, leading to performance slowdowns.

Once you have chosen, add one of the following entries:

chaseReferrals: True

multiDomainTrees: True

6. Decide on whether to use NTLM (“REMOTE_USER”) or KERBEROS authentication.
If you want to use NTLM/REMOTE_USER, then also add the following entry:

singleSignOnOption: IdentityMapping

Do not use this entry if you want to use Kerberos (which is the preferred option for many environments).
7. Perform a test on this namespace to make sure a connection can be made
8. Restart the service

From the web:
– universal group membership is replicated to all Global Catalogs (i.e. it has forest-wide replication scope). This can be beneficial (since it provides efficient way to retrieve group members) – but has its drawbacks (it increases volume of replication traffic).
– domain local groups do not have any limitations regarding their membership – i.e. they can contain accounts the same domain/forest or any trusted domain/forest. This does not apply to domain global groups (they can contain only accounts from the same domain) or universal groups (they can contain only accounts from the same forest).
– universal group is a security or distribution group that contains users, groups, and computers from any domain in its forest as members. You can give universal security groups rights and permissions on resources in any domain in the forest.
– global group is a group that can be used in its own domain, in member servers and in workstations of the domain, and in trusting domains. In all those locations, you can give a global group rights and permissions and the global group can become a member of local groups. However, a global group can contain user accounts that are only from its own domain.
– domain local group is a security or distribution group that can contain universal groups, global groups, other domain local groups from its own domain, and accounts from any domain in the forest. You can give domain local security groups rights and permissions on resources that reside only in the same domain where the domain local group is located.

Product:
Cognos BI 10.2.2
Microsoft Windows 2012 R2 ServerProblem:
What files should I save in a backup folder, before I apply a fix pack or do a upgrade of a Cognos BI 10.2.x installation?Solution:
If you have done advance tuning to the Cognos functions then this files are maybe updated;
…\c10_64\configuration\CQEConfig.xml
…\c10_64\configuration\cclWinSEHConfig.xml
…\c10_64\configuration\rsvpproperties.xml
…\c10_64\webapps\p2pd\WEB-INF\p2pd_deploy_defaults.properties
…\c10_64\webapps\p2pd\WEB-INF\xts.properties
…\c10_64\tomcat\conf\server.xml
…\c10_64\webapps\p2pd\WEB-INF\services\reportservice.xml
…\c10_64\webapps\p2pd\WEB-INF\services\batchreportservice.xml
…\c10_64\webapps\p2pd\WEB-INF\classes\vierwerconfig.properties
…\c10_64\templates\ps\portal\system.xml

You should keep a copy of the original file you change with the ending .org like system.xml.org. Then you should copy your updated file with a ending like .ibm – then if the fix pack overwrites your system.xml file you have a copy of the file in system.xml.ibm, that you can copy back after the updated.

If you have done report customization then there is this files you need to make a copy off;

GlobalReportStyles.css

8.x styles

Classes that were used in IBM Cognos 8 BI

GlobalReportStyles_none.css

Simplified styles

Classes that have minimal styling defined, useful for financial reports

GlobalReportStyles_1.css

1.x styles

Classes that were used in IBM Cognos ReportNet

GlobalReportStyles_10.css

10.x styles

Classes in the default style sheet for IBM Cognos 10 BI

They are in this folders

<c10_install>\bin\

The file in this location is used by Report Server for PDF and Microsoft Excel spreadsheet software outputs.

<c10_install>\webcontent\schemas\

The file in this location is used by IBM Cognos Viewer for HTML output.

<c10_install>\reportstyles\

The file in this location is not currently used.

<c10_install>\webcontent\reportstyles\

The file in this location is used by Report Studio.

Then you also may backup this files if you made changes there:
<c10_install>\webcontent\schemas\GlobalReportStyles_10.css.
<c10_install>\webcontent\pat\res\templates.xml.
<c10_install>\webcontent\pat\res\Resources.xml.
<c10_install>\webcontent\pat\res\reportstudio_en.xml.
<c10_install>\webcontent\pat\res\TableStyles.xml.
<c10_install>\webcontent\pat\res\ChartTemplates.xml.
<c10_install>\webcontent\pat\res\ReportPresets.xml.

You should also export a unencrypted cogstartup.xml file from each servers Cognos Configuration. Save this file in a separate folder like d:\temp\cogstartup backup 20171124.xml

You need to update the system.xml file. This is found in folder C:\Program Files\ibm\cognos\c10_64\templates\ps\portal\system.xml on the Cognos BI report (dispatcher) server and on the Content manager server. It is the Cognos Presentation service that create the web-page, so where this is running (true) there the files will be read. Best is to update it on all Cognos instances.

You can add user interface elements to IBM Cognos Connection to connect to external applications or to modify the functionality of IBM Cognos Connection. You can restrict access to these new user interface elements based on different user groups and roles.

To add a user interface element in IBM Cognos Connection, you must modify the portal system.xml file.

The xml:lang attribute of the label and tooltip elements in the system .xml file corresponds to the product locale in use at the time of the portal page generation. If a new product locale is added for IBM Cognos software, you must add a translation for the label and tooltip fields. When no label or tooltip is found that matches the product locale, nothing is displayed. The graphic that is referenced by the icon element must exist in the c10_location/webcontent/ps/portal/images directory.

Procedure
1. Stop the IBM Cognos service.
2. Open the c10_location/templates/ps/portal/system.xml file in an XML or text editor.
3. For the <system> element, add the <param name=”ui_add”> element:

<param name=”ui_add”>

<!–list of user interface elements–>

</param>

4. Within the <param name=”ui_add”> element, define all the custom elements that you want to add.

For example, you can add a link to the IBM website in the main header in IBM Cognos Connection:

5. For information about all the user interface elements that you can add, see the topic ““Elements You Can Add”. Ensure that you match the case of each user interface element that you want to add.

6. Specify one or more groups or roles that you want to access the new interface element by adding their IDs as values of the show attribute. Use the IDs as documented in the topic “Referencing the required groups or roles in the system.xml file”. Separate the IDs using spaces.

Here is an example:

<param name=”ui_add”>

<CC_VIEW_TOOLS>

<item show=”Administrators RSUsers g1 g2″>

<url></url>

<target>_blank</target>

<label xml:lang=”en”>

My_label in English

</label>

<label xml:lang=”fr”>

My_label in French

</label>

<label xml:lang=”de”>

My_label in German

</label>

<label xml:lang=”ja”>

My_label in Japanese

</label>

</item>

</CC_VIEW_TOOLS>

</param>

7. Save the system.xml file.
8. Restart the IBM Cognos service.Tip: You can have only one <param name=”ui_add”> element in the system.xml. Therefore, all items that you want to add must be placed inside this element.

If we want to create and modify classes that apply to all reports, we can modify the global Cognos style sheet. This is a useful strategy if we only have one corporate style for all reports.

There are four versions of the global Cognos style sheet as shown in Table below.

Four versions of the global Cognos style sheet

CSS Version

Report Style

Description

GlobalReportStyles.css

8.x styles

Classes that were used in IBM Cognos 8 BI

GlobalReportStyles_none.css

Simplified styles

Classes that have minimal styling defined, useful for financial reports

GlobalReportStyles_1.css

1.x styles

Classes that were used in IBM Cognos ReportNet

GlobalReportStyles_10.css

10.x styles

Classes in the default style sheet for IBM Cognos 10 BI

The exact CSS file used will be chosen based on how the report style is set for a given report. The default setting for IBM Cognos BI 10 is 10.x styles, as shown in Figure 8. You can open this dialog by selecting Report Properties from the File menu in IBM Cognos Report Studio.

Report Properties dialog above.

Each of the four CSS files identified above is installed by Cognos in four different locations, as shown in Table below.

Files are on both gateway and dispatcher (app) servers.

Directory

Description

<c10_install>\bin\

The file in this location is used by Report Server for PDF and Microsoft Excel spreadsheet software outputs.

<c10_install>\webcontent\schemas\

The file in this location is used by IBM Cognos Viewer for HTML output.

<c10_install>\reportstyles\

The file in this location is not currently used.

<c10_install>\webcontent\reportstyles\

The file in this location is used by Report Studio.

Update the file GlobalReportStyles_10.css in all above folders.

In the following example we will modify the IBM Cognos 10 BI global style sheet GlobalReportStyles_10.css. This style sheet is used by Cognos Viewer for HTML output.

The following steps are a simple modification where we will modify GlobalReportStyles_10.css to increase the font size.

Product:
Cognos BI 10.2.2 fix pack 7
Microsoft Windows 2012 R2 ServerIssue:
When a user from a different domain than the servers are in, try to login to Cognos Connection, they get this error message.Error:
CAM-AAA-0064
The function ‘bindToBestGCServer’ failed.Solution:
There are two Microsoft Windows domains, Domain A and Domain B, that have a forest trust. In Cognos Configuration you have setup two namespace – one for Domain A and one for Domain B. The Cognos servers are in Domain A.
On the Microsoft Windows server IIS manager you have set Windows authentication on the CGI-BIN folder for the Cognos Gateway.
The user selects the namespace he want to login to first when he reach the cognos connection webpage.
Inside Cognos Configuration you only need:
+ In the Value – Advanced properties window, click Add.
+ In the Name column, type singleSignonOption (Case sensitive)
+ In the Value column, type IdentityMapping (Case sensitive)
+ Click OK.
+ Save configuration and restart Service for the setting to take effect

…to make the login work.
If you have also enter multiDomainTree=true you get above error.
If you only have ONE namespace setup in Cognos, then if all domains are the same Active Directory Forest, you need to add this values
chaseReferrals = True
MultiDomainTrees = True

Solution is very depending one your network infrastructure setup, you need to test different configurations.

Authentication in One Domain Tree
If you set a parameter named chaseReferrals to true, users in the original authenticated domain and all child domains of the domain tree can log in to Cognos. Users above the original authenticated domain or in a different domain tree cannot log in.

Authentication in All Domain Trees in the ‘Forest’
If you set a parameter named MultiDomainTrees to true, users in all domain trees in the forest can log in to Cognos.

Problem:
How to determine the Service Pack of the Cognos Business Intelligence product installed?

Solution (copied from IBM website before it is removed):
The component list cmplst.txt file displayed a full list of installed components. It is found on any server with a full or partial installation of Cognos Business Intelligence.
The table below maps the various build numbers to their more commonly referenced release names:
The build number indicates the MR (Maintenance Release) version, as per the following table:

Steps:
Within the Cognos BI install folder, look for a file called cmplst.txt. The default installation location is c:\program files\cognos\
Within this file, look for [Product Update Information]. If this section is missing or blank, then you have the RTM (first release) installed. If the section is populated, reference the table above to determine the service pack installed.

If you do not have access to the component list file (cmplst.txt):
Hit Ctrl-F3 within Cognos Configuration to bring up a Properties menu
On the Installed Components tab, the build numbers will also be displayed

Product:
Cognos Business Intelligence (BI) 10.2.2 Fix pack 6
Microsoft Windows 2012 R2 serverIssue:
When adding a new domain to the list of namespaces in Cognos BI, during test or startup it give a error message.
New domain have in our example the name ExtADError message:
[‘ExtAD’]
[ ERROR ] CAM-AAA-0146 The namespace ‘ExtAD’ is not available.
[ ERROR ] CAM-AAA-0064 The function ‘Configure’ failed.
[ ERROR ] CAM-AAA-0089 The provider is not initialized.
[ ERROR ] CAM-AAA-0036 Unable to authenticate because the credentials are invalid.
[ ERROR ] ADSI Error:
8009030C: LdapErr: DSID-0C09053E, comment: AcceptSecurityContext error, data 52e, v1db1
System Error:
The user name or password is incorrect.Possible Solution:
The user logged into the Windows server where you have Cognos Configuration, does not have a account (or trust) in the new domain, so the test fail and the new Active Directory namespace is not shown.
Start Cognos Configuration and update the new namespace values
Enter a windows service account in the Bindings Credentials row in Cognos Configuration for the new namespace.
Enter in the format: domain.com\username
and the password (because it is a service account the password will never change).
Save the changes and restart the Cognos BI service where the content manager are.
Test to surf to the gateway again.

If Cognos 8 is running on the machine in the same forest as the configured domain/forest, you do not need to specifically set the bind credentials. However, if you run cross forest, then, you must provide the bind credentials

You would also need the binding credentials if AD is not configured to allow anonymous bind

Problem:
No picture shown in the PDF report, but they show nice in a HTML report.

Solution:
If you have SSO with IIS, then you need to set Anonymous Authentication on the folders where the images are stored.
This can be more than one folder, depending on where you have your company reports pictures stored.
The sample pictures are stored in folder c:\Program Files\ibm\cognos\analytics\webcontent\bi\samples\images

So you need to start IIS Manager
Expand to your IBMCOGNOS folder
Expand down to bi/samples
Mark images folder and click on Authentication icon
Mark Anonymous Authentication and click on Enable text, to change status to Enabled
Exit IIS
Try to run the report as PDF again.

You can also ensure that the account running the Cognos BI services have full rights to the images folder in NTFS file system.

On a new installed Cognos BI 10.2.2 where you have upgraded an old Content store from Cognos BI 10.1.1 you get an error message when you in Cognos connection go to Administer IBM Cognos content and look at Current Activities.

Go to the SQL server and login to Microsoft SQL Server Management Studio.

Paste above script in the Query window.

Execute it on the Content Store database.

This will erase the NC tables and any data therein.

Start the Cognos BI service from Cognos Configuration to recreate the tables.

Test to surf to Cognos Connection.

If this does not help, then create a empty database and setup Cognos BI against that empty content store. Then after you have to export a deployment of all content from Old Cognos BI and import it into the new Cognos BI environment. But you will not get the “my folders” content with you in this deployment case. Then you have to use other methods to move the content.